Develop (#63)

* feature/automatic-csproj (#23) * adding dynamic detection of csproj, yarn.lock, package-lock.json and requirements.txt * file path by ext unity tests * Template email of organization invited (#22) * e-mail Added the template of e-mail to a user is invited to the organization * Fixing go lint * 🔒 The screen dashboard of organization is visible something the admin users (#26) * Organizing i18n values in frontend (#30) * Rewrite i18n values for external pages and dashsboard screen * Adjusting i18 values in repositories screen * 🛠️ Adjusting redirect routes when the call is external of manager (#19) * Hotfix/fixing redirect and output bigger (#21) * Fixing redirect in email template reset-password * Fixing code output when exists many content and bad read * Fixing fmt and set total output to down * Hotfix/unique names (#28) * Adding unique names migration * Adding validations to unique names and unity tests * Fixing swagger in horusec-analytics (#27) * Add i18n values to enUS Co-authored-by: Wilian Gabriel <63816070+wiliansilvazup@users.noreply.github.com> Co-authored-by: nathanmartinszup <63246935+nathanmartinszup@users.noreply.github.com> * Removing fields type, vulnerableBellow and version from Vulnerability (#24) * Removing fields type, vulnerableBellow and version from Vulnerability * Fixing e2e and unit testss * Change pipeline to use docker-compose * Fixing docker-compose.test * Fixing deployment * Fixing compose * Merge master into develop (#36) * 🛠️ Adjusting redirect routes when the call is external of manager (#19) * Hotfix/fixing redirect and output bigger (#21) * Fixing redirect in email template reset-password * Fixing code output when exists many content and bad read * Fixing fmt and set total output to down * Hotfix/unique names (#28) * Adding unique names migration * Adding validations to unique names and unity tests * Fixing swagger in horusec-analytics (#27) * Hotfix/change images generate token (#31) * Change images to generate token * Adding gif usage horusec * Adding gif usage horusec Co-authored-by: Lucas Bruno <69604366+lucasbrunozup@users.noreply.github.com> Co-authored-by: nathanmartinszup <63246935+nathanmartinszup@users.noreply.github.com> * Adding company role in get all companies (#33) * Adding company role in get all companies * Adding unity tests * Tokens of organization (#32) * 🔑 Handler tokens of organization * 🛡️ Added rules in manager organizations * Not found screen (#34) * 👷 Initial structure to not found page * 👌 Finalizing page of not found * 🔙 Added option to back to organization screen when in home page * 🔨 Fixing version in package json * Fixing error in unique company name not necessary, and removings wrong constraints in database (#38) * [skip ci] update versioning file * Added component of pagination (#47) * CLI docker image (#25) * Adding cli dockerfile * Adding horusec as entrypoint * Removing docker from image * Adding docker-entrypoint * Using docker dind * Downgrade docker dind * Using entrypoint * Renaming entrypoint to horusec-cli * Updating documentation * Adding license * Updating vendor Co-authored-by: Horusec <horusec@zup.com.br> * 💅 Adjusting button dialog styles, scrollbar and select component (#48) * Adjusting the texts in portugueses (#52) * ✅ Added option to success message from flash message component and added in all handlers (#53) * Feature/create repository cli (#55) * Create repository by cli flag, update list repository to list all repositories to company admin * Adding tests and validation to list all repositories of company if i am admin * Removing duplicated code to list repositories to company admin * Removing unnecessary unity test * Fixing unity tests and adding middleware to company admin * Adding missing test * Updating analytic routes by repository to accept admins of company * Fixing broken e2e tests Co-authored-by: Wilian Gabriel <wilian.silva@zup.com.br> * Frontend false positive (#54) * Initial strucute for false positive screen * Finished false posite screen and add supervisor role * Implementing false-positive and risk accept (#35) * Change struct of analysis * Fixing fmt lint entity and create migration files * Adding get all dto and method * Fixing migration * Adding base management repository * Adding get all vuln management data * Adding management repository unity tests * adding management controller get all * adding get all management data * adding management handler unity tests * Adding update method in repository * Adding update method in controller * adding management handler put * Adding management handler unity tests * Fixing create analysis * Adding app sec role * Fixing list vuln management error where vulns are duplicating, fixing swagger errors * Removing unnecessary nolint and improving code * Fixing to send analysis correctly to horusec-api * Adding separated api to update status and type * Adding new vulnerability status and type enums * Fixing lint * Fixing lint errors * Removing status and updating apis * Updating migration * Fixing output to show vulnerability to fix * Fixing lint and project errors * Fixing management unit tests * Fixing errors in list vulns * Fixing some type errors * Updating output to print false positive and risk accept * Start fixing tests * Fixing tests * Fixing vulnerabilities unity tests * Fixing analytic queries * Fixing tests * Fixing analytic repositoty unit tests * Adding tests on cli * Adding more content * Fixing hash generator * Fixing hash generator * Fixing vulnerability test * Adding devkit entities and types units tests * Adding Unit tests * Adding unit tests * Fixing license * Adding analysis tests * Fixing lint * fixing e2e tests * Updating e2e tests * Fixing tests in repository * FIxing fmt lint * Parse horusec analysis response correctly * Fixing lint * Fixing errors in vulns details * Fixing e2e test * Updating api cors * Updating cors Co-authored-by: nathan <nathan.martins@zup.com.br> Co-authored-by: lucas.bruno <lucas.bruno@zup.com.br> * Fixing wrong text in output * Bugfix/false positive (#58) * Fixing supervisor middleware validation to company admins * Fixing load data in vulnerabilities table * Fixing false positive in CLI * Updating swagger * Fixing docs * Fixing lint Co-authored-by: lucas.bruno <lucas.bruno@zup.com.br> Co-authored-by: Wilian Gabriel <wilian.silva@zup.com.br> * Fixing regex d34b3ba5-b988-4a0f-9344-467274cd98be (#59) * Removing deprecated manager (#60) * Fixing security pipeline in horusec (#61) * Fixing security pipeline in horusec * Fixing security pipeline in horusec * Fixing security pipeline in horusec * Fixing security pipeline in horusec * Fixing readme cli * Fixing readme cli * Update README.md * Update README.md * Change filter to receive Severity and remove Type (#64) * Feature/improving false positive (#66) * Adding order by severity and type * Adding filter by type * Fixing lint errors and adding unity tests * Fixing order by error * Updating swagger * Fixing fmt errors * [Frontend] Improvements false positive (#67) * Added new filter in false positive screen * Added success messages * Added tag with color in severity * List vulnerabilities in management screen to repository members (#68) * [Frontend] - Improvements false positive (#69) * Added new filter in false positive screen * Added success messages * Added tag with color in severity * Removing supervisor role in company * Added permission to handler repository Co-authored-by: nathanmartinszup <63246935+nathanmartinszup@users.noreply.github.com> Co-authored-by: Lucas Bruno <69604366+lucasbrunozup@users.noreply.github.com> Co-authored-by: nathannascimentozup <65020170+nathannascimentozup@users.noreply.github.com> Co-authored-by: Horusec <horusec@zup.com.br> Co-authored-by: nathan <nathan.martins@zup.com.br> Co-authored-by: lucas.bruno <lucas.bruno@zup.com.br>
ZupIT · Oct 19, 2020 · 8f69c61 · 8f69c61
1 parent b97cd04
commit 8f69c61
Show file tree

Hide file tree

Showing 341 changed files with 7,473 additions and 24,804 deletions.
diff --git a/.github/workflows/security-pipeline.yml b/.github/workflows/security-pipeline.yml
@@ -14,8 +14,15 @@ jobs:
     steps:
       - name: Check out code into the Go module directory
         uses: actions/checkout@v2
-      - name: Running Horusec Security
+      - name: Running Horusec Security Download latest version
         shell: bash
         run: |
           curl -fsSL https://horusec-cli.s3.amazonaws.com/install.sh | bash
           horusec start -p="./"
+      - name: Running Horusec Security Running current version
+        shell: bash
+        run: |
+          go build -o horusec ./horusec-cli/cmd/horusec/main.go
+          chmod +x horusec
+          sudo mv horusec /usr/local/bin
+          horusec start -p="./" -e="true"
diff --git a/.semver.yaml b/.semver.yaml
@@ -1,4 +1,4 @@
-alpha: 0
+alpha: 1
 beta: 0
 rc: 0
 release: v1.0.1
diff --git a/Makefile b/Makefile
@@ -18,10 +18,10 @@ coverage-horusec-api:
 	deployments/scripts/coverage.sh 99 "./horusec-api"
 coverage-horusec-cli:
 	chmod +x deployments/scripts/coverage.sh
-	deployments/scripts/coverage.sh 82 "./horusec-cli"
+	deployments/scripts/coverage.sh 90 "./horusec-cli"
 coverage-horusec-messages:
 	chmod +x deployments/scripts/coverage.sh
-	deployments/scripts/coverage.sh 85 "./horusec-messages"
+	deployments/scripts/coverage.sh 98 "./horusec-messages"
 coverage-horusec-account:
 	chmod +x deployments/scripts/coverage.sh
 	deployments/scripts/coverage.sh 98 "./horusec-account"

diff --git a/README.md b/README.md
@@ -42,6 +42,8 @@ Currently, performance analysis consists of:
 
 You can see more details about the horusec <a href="assets/horusec-complete-architecture.jpg">/assets/horusec-complete-architecture.jpg</a>
 
+### For more details see our [DOCUMENTATION](https://zup-products.gitbook.io/horusec)
+
 ## Project roadmap
 
 We started the project to aggregate within our company, but as the search grew more and more we chose to apply good practices and open it up for everyone to collaborate with this incredible project.

diff --git a/deployments/dockerfiles/bandit/Dockerfile b/deployments/dockerfiles/bandit/Dockerfile
@@ -1,3 +1,17 @@
+# Copyright 2020 ZUP IT SERVICOS EM TECNOLOGIA E INOVACAO SA
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 FROM python:3.6-alpine as builder
 
 # Install and compile bandit + its dependencies

diff --git a/deployments/dockerfiles/brakeman/Dockerfile b/deployments/dockerfiles/brakeman/Dockerfile
@@ -1,3 +1,17 @@
+# Copyright 2020 ZUP IT SERVICOS EM TECNOLOGIA E INOVACAO SA
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 FROM ruby:2.4-alpine
 
 RUN apk update && apk upgrade \

diff --git a/deployments/dockerfiles/gitleaks/Dockerfile b/deployments/dockerfiles/gitleaks/Dockerfile
@@ -1,3 +1,17 @@
+# Copyright 2020 ZUP IT SERVICOS EM TECNOLOGIA E INOVACAO SA
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 FROM zricethezav/gitleaks
 
 COPY rules.toml /rules/rules.toml

diff --git a/deployments/dockerfiles/gosec/Dockerfile b/deployments/dockerfiles/gosec/Dockerfile
@@ -1,3 +1,17 @@
+# Copyright 2020 ZUP IT SERVICOS EM TECNOLOGIA E INOVACAO SA
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 FROM securego/gosec:latest
 
 RUN apk --no-cache add ca-certificates openssh-client jq

diff --git a/deployments/dockerfiles/npmaudit/Dockerfile b/deployments/dockerfiles/npmaudit/Dockerfile
@@ -1,3 +1,17 @@
+# Copyright 2020 ZUP IT SERVICOS EM TECNOLOGIA E INOVACAO SA
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 FROM node:alpine
 
 RUN apk update && apk upgrade \

diff --git a/deployments/dockerfiles/safety/Dockerfile b/deployments/dockerfiles/safety/Dockerfile
@@ -1,3 +1,17 @@
+# Copyright 2020 ZUP IT SERVICOS EM TECNOLOGIA E INOVACAO SA
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 FROM python:3.6-alpine as builder
 
 # Install and compile safety + its dependencies

diff --git a/deployments/dockerfiles/securitycodescan/Dockerfile b/deployments/dockerfiles/securitycodescan/Dockerfile
@@ -1,3 +1,17 @@
+# Copyright 2020 ZUP IT SERVICOS EM TECNOLOGIA E INOVACAO SA
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 FROM mcr.microsoft.com/dotnet/core/sdk:3.1-alpine
 
 RUN apk add --no-cache bash jq openssh-client alpine-sdk

diff --git a/deployments/dockerfiles/spotbugs/Dockerfile b/deployments/dockerfiles/spotbugs/Dockerfile
@@ -1,3 +1,17 @@
+# Copyright 2020 ZUP IT SERVICOS EM TECNOLOGIA E INOVACAO SA
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 FROM openjdk:16-jdk-alpine
 
 RUN apk update && apk upgrade \

diff --git a/deployments/dockerfiles/tfsec/Dockerfile b/deployments/dockerfiles/tfsec/Dockerfile
@@ -1,3 +1,17 @@
+# Copyright 2020 ZUP IT SERVICOS EM TECNOLOGIA E INOVACAO SA
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 FROM golang:1.14-alpine
 
 RUN apk update && apk upgrade \

diff --git a/development-kit/pkg/databases/relational/adapter/adapter_test.go b/development-kit/pkg/databases/relational/adapter/adapter_test.go
@@ -115,14 +115,14 @@ func executeCRUD(instanceRead relational.InterfaceRead, instanceWrite relational
 
 func getAnalysisData() EntitiesHorusec.Analysis {
 	return EntitiesHorusec.Analysis{
-		ID:              uuid.New(),
-		CreatedAt:       time.Now(),
-		RepositoryID:    uuid.New(),
-		CompanyID:       uuid.New(),
-		Status:          EnumHorusec.Success,
-		Errors:          "",
-		FinishedAt:      time.Now(),
-		Vulnerabilities: []EntitiesHorusec.Vulnerability{},
+		ID:                      uuid.New(),
+		CreatedAt:               time.Now(),
+		RepositoryID:            uuid.New(),
+		CompanyID:               uuid.New(),
+		Status:                  EnumHorusec.Success,
+		Errors:                  "",
+		FinishedAt:              time.Now(),
+		AnalysisVulnerabilities: []EntitiesHorusec.AnalysisVulnerabilities{},
 	}
 }
 func TestCRUD_Relational(t *testing.T) {

diff --git a/...g/databases/relational/migration/20201002082520_create-nn-analysis-vulnerability.down.sql b/...g/databases/relational/migration/20201002082520_create-nn-analysis-vulnerability.down.sql
@@ -0,0 +1,13 @@
+BEGIN;
+
+DROP TABLE IF EXISTS analysis_vulnerabilities CASCADE;
+
+ALTER TABLE vulnerabilities DROP COLUMN "type";
+
+ALTER TABLE vulnerabilities ADD analysis_id UUID NOT NULL;
+
+ALTER TABLE vulnerabilities ADD FOREIGN KEY (analysis_id) REFERENCES analysis (analysis_id) ON DELETE CASCADE;
+
+ALTER TABLE vulnerabilities ALTER COLUMN vuln_hash TYPE varchar(40) USING vuln_hash::varchar;
+
+COMMIT;
diff --git a/...pkg/databases/relational/migration/20201002082520_create-nn-analysis-vulnerability.up.sql b/...pkg/databases/relational/migration/20201002082520_create-nn-analysis-vulnerability.up.sql
@@ -0,0 +1,16 @@
+ALTER TABLE vulnerabilities DROP CONSTRAINT vulnerabilities_analysis_id_fkey;
+
+ALTER TABLE vulnerabilities DROP COLUMN analysis_id;
+
+ALTER TABLE vulnerabilities ADD COLUMN "type" varchar(255) NOT NULL;
+
+ALTER TABLE vulnerabilities ALTER COLUMN vuln_hash TYPE varchar(255) USING vuln_hash::varchar;
+
+CREATE TABLE analysis_vulnerabilities (
+     vulnerability_id uuid NOT NULL,
+     analysis_id uuid NOT NULL,
+     created_at DATE NOT NULL,
+     FOREIGN KEY (vulnerability_id) REFERENCES vulnerabilities (vulnerability_id) ON DELETE CASCADE,
+     FOREIGN KEY (analysis_id) REFERENCES analysis (analysis_id) ON DELETE CASCADE,
+     PRIMARY KEY (analysis_id, vulnerability_id)
+);